What is the CVSS score of EUVD-2026-14156?

EUVD-2026-14156 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14156?

Organizations using all should be aware of moderate risk from CVE-2026-3354, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate EUVD-2026-14156?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14156

| CVE-2026-3354 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-9mc9-jxch-8r4v

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14156

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

The Wikilookup plugin for WordPress versions up to 1.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'Popup Width' setting due to insufficient input sanitization and output escaping. Authenticated attackers with Administrator-level access can inject arbitrary JavaScript that executes for all users viewing affected pages, but only in multi-site installations or where the unfiltered_html capability has been disabled. With a CVSS score of 4.4 and high attack complexity requirements, this represents a low-to-moderate real-world threat that requires both administrative access and specific WordPress configurations to exploit.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational cross-site scripting weakness. The Wikilookup plugin (CPE: cpe:2.3:a:mooeypoo:wikilookup:*:*:*:*:*:*:*:*) fails to properly sanitize user input in the 'Popup Width' setting before storing it in the WordPress database, and subsequently fails to escape output when rendering the setting in administrative pages. Code review of the vulnerable file (views/admin_wikilookup_display.php line 26) confirms the plugin directly echoes unsanitized settings without applying WordPress escaping functions such as wp_kses_post() or esc_attr(). The vulnerability specifically manifests in stored XSS context, meaning malicious payloads persist in the database and execute upon subsequent page loads, unlike reflected XSS which requires user interaction with a crafted URL.

RemediationAI

Upgrade the Wikilookup plugin to a patched version after version 1.1.5 has been released by the maintainer (mooeypoo). Users should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate Wikilookup, and apply the available update when released. Until a patch is available, administrators can implement temporary mitigations: (1) restrict Administrator role access via role-based access control plugins, limiting who can modify Popup Width settings; (2) in single-site installations, enable the unfiltered_html capability to prevent the XSS from executing (though this has its own security implications); (3) regularly audit the Wikilookup settings in the WordPress database to detect any suspicious script injections. For multi-site installations where patching is delayed, consider temporarily deactivating the Wikilookup plugin until updates are available. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7526228-4e21-430c-90ad-1476c81698ad?source=cve for vendor guidance.